How this server signs people in.
Public: the Studio reads it before anyone is signed in, to show the setup screen or the sign-in methods.
Public: the Studio reads it before anyone is signed in, to show the setup screen or the sign-in methods.
The sign-in configuration.
application/json- response
auth_disabled*booleanSign-in is off (AUTH_DISABLED): every request is the local admin.
setup_required*booleanNo admin who can sign in exists yet, so the Studio shows the setup screen. The setup code is in the server log.
methods*curl -X GET 'https://sluby.example.com/api/v1/auth/config'{ "auth_disabled": true, "setup_required": true, "methods": { "password": true, "github": true }}The provider's redirect back after sign-in. GET
Browser-facing: every outcome is a redirect into the Studio. Accepted only from the browser that started the sign-in: the `state` must match the `sluby_signin` cookie set by the login route, within ten minutes. The account is the provider's stable id (GitHub: the numeric account id), never the login. A failure redirects to the page the sign-in started from (or `/studio` once the handshake is lost) with `signin_error=<code>` added: `expired_handshake` (expired, or started in another browser), `not_a_member` (with `&handle=<login>`, nobody added this account; people join through invites), `disabled` (with `&handle`, an admin removed the member), `already_linked` (with `&handle`, joining or linking with an account another member already signs in with), `not_signed_in` (a link finished without the session it began in), `invite_not_found`, `invite_used`, `invite_expired`, `invite_revoked` (with `&handle`, joining with an invite that does not work), `cancelled` (the person declined at the provider), `provider_failed` (the provider refused the code or could not be reached) or `not_configured`. A join signs the new member in; a link keeps the current session.
Set up the first admin with the setup code, and sign in. POST
Works while `setup_required` is true: no admin who can sign in exists. The code is printed in the server log at startup. 10 attempts per client address in 10 minutes.